Title

The BlackBerry 10 OS Work Space must only install and use DoD PKI-issued or DoD-approved software authentication certificates. (Cat I impact)

Discussion

If unauthorized software authentication certificates are installed on the device, then the operating system would not block malware signed by the entity that published these certificates. Such malware could be used to obtain sensitive DoD information or to further breach system security. Eliminating unapproved software authentication certificates greatly mitigates the risk of malware passing authentication controls.

Check Content

From the Work Space, navigate to "Settings >> Security and Privacy >> Certificates", and throughout different enterprise certificate stores ("Enterprise Root Certificates", "Enterprise Intermediate Certificates", and "Enterprise Client Certificates"). Verify the certificates listed originated from the BDS server. If the certificates do not originate from a DoD BDS server, this is a finding. NOTE: Certificates in stores other than enterprise certificate stores do not apply.

Fix Text

On BlackBerry Device Service, remove the corresponding .pem file from this folder: <drive>:\<shared_network_folder>\Shared\Certificates\<ENTERPRISE/VPN/WIFI/www>

Additional Identifiers

Rule ID:

Vulnerability ID: V-47203

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.